Skip to content
Declara
⌘K
compliance-ownerengineer

Publish a security advisory

Was this page helpful?

This page reflects our reading of Cyber Resilience Act, Article 14(8) and Annex I Part II(4) as of . It is not legal advice. Review process.

The Regulation asks you to tell users about an actively exploited vulnerability and what to do about it (Art. 14(8)), and to share information about fixed vulnerabilities once an update is out (Annex I Part II(4)). It does not name a format. A security advisory in CSAF 2.0 is the one national CSIRTs and most scanners read, so a notice your customers' tooling can act on, not only their people.

Before you start

  • A vulnerability case. Incidents and drills have no advisory.
  • At least one affected version named on the case. The advisory says what it affects.
  • A published disclosure page (Disclosure in the navigation). The advisory names it as the address of its publisher, and the public copy is served from it.
  • cases.write to draft. cases.submit to publish or list, the same permission as filing a stage.

Steps

  1. Open the case and find Security advisory, beside the notice to affected users. Press Draft a security advisory. A tracking id such as ACME-SA-2026-0001 is assigned.
  2. Edit the draft: title, summary, optional details, The fix, an optional https link to the fix, and fixed in for each product on the case. The affected versions come from the case; the CVE, EUVD id, CVSS and references come from the advisory the case was opened from.
  3. Press Save draft. Download draft JSON gives you the document as it would be published, to check in a CSAF validator first if you want to.
  4. Press Publish. Before anything is published, Declara runs the CSAF 2.0 checks the JSON schema cannot express (a product id used but never defined, a product both fixed and affected, a gap in the revision history). If any fails, it says what to change.
  5. Press List publicly when you want it public. Publishing and listing are separate on purpose: a revision can be published and kept internal.

To correct a published advisory, edit it and press Publish revision 2 (and so on). Say what changed; it goes into the revision history every reader sees. A published revision is never edited in place.

What you should see

Once listed:

  • https://<your disclosure page>/advisories lists it for people.
  • https://<your disclosure page>/.well-known/csaf/provider-metadata.json is the CSAF provider metadata aggregators and scanners look for, with the documents under /.well-known/csaf/white/<year>/, each with a .sha512 file, plus index.txt and changes.csv.
  • Your security.txt gains a CSAF: line pointing at the provider metadata.
  • GET /api/v1/advisories returns it, with the published document. See the API reference.

Only the published revision is ever served; edits to the draft behind it stay private until you publish them.

Related